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Abstract 

In the absence of any efficient classical schemes for verifying a universal quantum computer, 
the importance of limiting the required quantum resources for this task has been highlighted 
recently. Currently, most of efficient quantum verification protocols are based on cryptographic 
techniques where an almost classical verifier executes her desired encrypted quantum compu¬ 
tation remotely on an untrusted quantum prover. In this work we present a new protocol for 
quantum verification by incorporating existing techniques in a non-standard composition to 
reduce the required quantum communications between the verifier and the prover. 


1 Introduction 

As quantum technology scales, verifying that a quantum black box device does what it promises 
becomes a difficult problem [1]. In particular, verification implies that the probability of accepting 
the output returned by a remote quantum computation and the output being incorrect, can be made 
arbitrarily small. Providing a solution to this problem is crucial in the context of secure delegated 
quantum computing where a weak verifier is required to perform a complex computation with the 
help of an untrusted quantum prover M. Also, in lab settings, where an experimentalist wants 
to verify that the state returned by a scalable quantum experiment is correct, standard techniques 
like quantum tomography become intractable, for few examples see |10m3j . 

To achieve a practical verification protocol (from the verifier’s point of view) one aims to min¬ 
imise the required resources of the verifier. This means optimising the number of operations that the 
verifier has to apply as well as reducing the classical and quantum communication rounds between 
verifier and prover, while limiting the quantum capabilities of the verifier in terms of the states 
preparation and quantum operations he can apply. Recently several verification protocols have been 
proposed, each targeting particular aspects of the above optimisation goal [HIISHEIIIIHIS]. 

In this paper we are concerned with two such protocols, one with an optimal state preparation, 
proposed by Fitzsimons and Kashefi (referred to here as the FK protocol |5]), the other with better 
communication cost scaling proposed by Aharonov, Ben-Or and Eban (referred to here as the ABE 
protocol and is the second of the two protocols presented in [6]). In the FK protocol the verifier 
is required to have the minimal quantum capacity of preparing single random qubits, while due 
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to the complexity of the underlying resource state necessary for the prover’s universal quantum 
computation, the communication overhead is quadratic in the input size. In contrast, the ABE 
protocol enjoys a linear overhead in the input size however the cost is the verifier’s requirement of 
preparing highly entangled secretly encoded states which scale with the security parameter. The 
main contribution of this paper is to show how we can keep the best of the two approaches. In 
doing so we ought to prove several new properties of these two protocols that could become useful 
in other context as well. 

Our FK-ABE hybrid protocol is based on the blindness property of the FK protocol where 
the prover does not learn anything about the computation. Hence, the verifier can remotely and 
securely prepare the entangled encoded state needed for the ABE protocol on the prover side. After 
this preparation stage is performed via the FK protocol, without obtaining the state back, verifier 
continues with the steps of the ABE protocol to perform the (public) logical computation and 
check if the output state is valid. Crucially, as we prove, the techniques of the FK protocol can be 
used separately for the preparation of each encoded input state of the ABE protocol, avoiding the 
construction of a global quadratic size resource state used in the original FK protocol. Hence the 
overall complexity of the hybrid protocol remains linear in the input size while we get the advantage 
of preparing single qubit states (in this case qudit to match the ABE protocol) as opposed to the 
highly entangled encoded states required for the original ABE protocol. However, several issues 
had to be resolved in order to construct the hybrid protocol. 

• The verification procedure of the FK protocol involves measuring special trap qubits that are 
placed at random positions including among the output system (the final qubits not measured 
by prover). In order to keep the verifier as simple as possible, i.e. not requiring any quantum 
memory capability, unlike the original FK protocol, the final output state prepared at the 
first stage of the hybrid protocol is not returned to the verifier. However the position of the 
actual output of the computation should be made public so that prover can apply the public 
logical circuit of the ABE protocol. This is achieved by adding extra blind computation steps 
that localise the position of the output without leaking the positions of the traps. 

• The final output of the modified localising protocol, as explained above, by construction does 
not contain any traps. Therefore the prover can replace this state by any state of his choice 
and there is no mechanism for the verifier to detect his deviation. However, we show that, due 
to blindness, the output state has the correct structure to be verifiable by the ABE protocol 
stage of the hybrid protocol and can possibly be used in any other hybrid compositions that 
involve similar verification techniques. 

• The ABE protocol has to be proved to be robust, since due to the above mentioned issues, 
the output prepared by the FK protocol stage could be deviated from the ideal ABE protocol 
input. We show that as long as the deviation is independent of any secret parameter of the 
verifier the ABE protocol succeeds. 

• Finally, we also prove that the classical communication between verifier and prover, necessary 
for executing the logical circuit computation in the ABE protocol, does not leak any informa¬ 
tion that violates the blindness requirement in the context of the hybrid protocol, thus not 
affecting the verification property. 

1.1 Related work 

A different verification approach was proposed in [7] where the verifier is fully classical but the 
computation is delegated to non-signalling entangled provers and the communication overhead is 
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huge due to the rigidity requirement for testing CHSH inequalities. While the communication of 
this protocol has been improved recently [nm?!, also through a hybrid composition with the FK 
protocol, however the bound achieved there is substantially higher (at least quartic) than the linear 
bound of the presented protocol. Other work on quantum verification includes [3] where there is a 
restriction on the permitted set of functions, referred to as random verifiable. In [8] a verification 
protocol is presented with the focus being on constructing a quantum one time program rather 
than improving on the practicality of verification. In [18] a verification protocol is given where 
the prover is able to send quantum states back to the verifier which has the capacity to measure 
them. Focusing on the blindness property only, several recent papers |19II21] have achieved better 
than linear bound while compromising either unconditional security property or simplicity of the 
verifier quantum operation. We believe that it may be worthwhile to explore these new blindness 
techniques with the goal of designing more efficient verification protocols. 

Before formalizing the main results of this paper, we give a short overview of the FK and ABE 
protocols. 

1.2 Overview of the FK and ABE protocols 

A security property that is defined in the delegated computing scenario and used as a stepping 
stone in the construction of the FK protocol is blindness [5]. The verifier (Alice) wants to delegate 
a computation to the prover (Bob) while hiding both the input and the computation. Bob’s possible 
deviation is not constrained in any way. 


Definition 1 (Perfect Blindness). Let P be a protocol for delegated computation: Alice’s input is a 
description of a computation on a quantum input, which she needs to perform with the aid of Bob 
and return the correct quantum output. Let pab denote the joint initial state of Alice and Bob and 
aAB their joint state after the execution of the protocol, when Bob is allowed to do any deviation 
from the correct operation during the execution of P, averaged over all possible choices of random 
parameters by Alice. The protocol P is perfectly blind if 

'ipAB G C{'Hab),^£ ■ C,{TLb) C{TiB), S.t. TrA{(TAB) = £{TrA{pAB)) (1) 

In the verification cryptographic setting Alice wants to delegate a quantum computation to Bob 
and accept or reject the result depending on whether the returned outcome is correct, or Bob has 
deviated]^ This definition only concerns pure state inputs and unitary computations. 


Definition 2 (Verifiability). A protocol for delegated computation is e-verifiable (0 < e < 1) if for 
any choice of Bob’s strategy j, it holds that for any input of Alice: 

TrC^p{u)PfncorrectBj{l^)) < £ (2) 

lA 

where Bj{v) is the state of Alice’s system A at the end of the run of the protocol, for choice of 
Alice’s random parameters v and Bob’s strategy j. If Bob is honest we denote this state by Bo{u). 
Let P± be the projection onto the orthogonal complement of the the correct quantum output. Then, 

Prncorrect = P±^\^CC){ACC\ (3) 

where \ACC) is the accept state for the indicator that Alice sets at the end of the protocol. 

*In this work we will assume that the apparatuses of Alice and Bob are perfect. Without this assumption on Bob, 
the protocol will also detect any errors which may stem from Bob’s faulty devices. 
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The main idea of the FK protocol is to test prover’s honesty by hiding trap qubits among 
all qubits sent by verifier, in a way that they do not affect the result of the actual computation. 
Blindness means that prover cannot learn the position of the trap, nor its state. During the execution 
of the measurement based computation prover is asked to measure this trap qubit and report the 
result to verifier. If prover is honest this measurement gives a deterministic result, which can be 
verihed by verifier and hence a dishonest sever will be detected with no-zero probability. Moreover 
the computation is encoded in a quantum error correcting code (QECC) correcting up to d errors, 
forcing malicious Bob to cause larger errors, if he is to interfere with the computation. These larger 
errors, in turn, are more easily detected. 

Sketch of the FK protocol (Protocol 8 in [5]) 

1. Alice has a description of a computation in the measurement-based quantum computing 
(MBQC) model. She encodes the computation in a fault tolerant MBQC pattern, using a 
QECC that detects d errors. 

2. Alice designs classically the embedding procedure of the encoded computation into a suitable 
MBQC pattern where the vertices can be divided into subsets S-f where each subset contains 
a computational qubit and a trap qubit placed at a random position inside the subset. For 
the purpose of separating the computational and the trap qubits, special ‘dummy’ qubits 
prepared in the computational basis are injected. 

3. Alice prepares all single qubits needed to construct the underlying entangled state for the 
pattern computation, pre-rotated by a random angle around Z axis in order to hide the 
measurement angle. 

4. Bob receives the qubits one by one and entangles them to construct the underlying entangled 
state. 

5. Alice sends to Bob at each step the measurement angles that implement the computation 
adapted based on the previous measurements results as well as cancelling the pre-rotation 
while adding a bit flip on the outcome to hide the measurement result. 

6. Alice receives the measurement result and corrects it. 

7. The isolated traps qubits are measured in the basis of their pre-rotated angles so the outcome 
is deterministic if Bob is honest. 

8. At the end Alice accepts the outcome returned by Bob if all traps give the correct outcome. 


In the following Lemma a distinction is made between the off-line phase of the protocol which 
Alice and Bob can execute before Alice receives the actual input, which is the description of the 
computation, and the on-line phase in which Alice and Bob repeatedly communicate to perform 
the measurements and corrections on the entangled state. 


Lemma 1. The FK protocol is perfectly blind (Theorem 12 in and e-verifiable where e = ^ 
(Theorem 13 in fSf) where di is the number of errors detectable by the QECC used for amplification 
and some constant c > 1. The quantum requirement of Alice is to prepare single qubit states and 
the communication requirement is 0(nf) x 0{log{l/e)) separable single qubit states sent from Alice 
to Bob off-line and O(n^) x 0{log{l/€)) bits of on-line classical communication between Alice to 
Bob, where n is the size of the computation. 
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The number of of errors di detectable by the QECC used for amplification will be referred to 
as the security parameter of the FK protocol in the rest of this paper. 

In the ABE protocol the input is encoded by Alice using a secretly randomised QECC with 
specific properties that allow for the secret updating of the random key throughout the execution 
of the computation. It is then hard for Bob, without the knowledge of the key to deviate while 
keeping the state inside the legal subspace. The computation performed on the encoded input can 
be publicly announced without compromising the verifiability of the protocol. 

Sketch of the ABE protocol (Protocol 4.2 in [6]) 

1. Alice has a description of a computation in the gate teleportation model where the non-Clifford 
operations are performed using non-Clifford magic states, Clifford gates and computational 
basis measurements. 

2. She encodes the input (typically the blank state) to the computation in a qudit polynomial- 
QECC code and translates the computation to a logical one where a universal set of gates can 
be implemented transversally in this computation model. We refer to this public encoding of 
the computation as the public polynomial-QECC logical circuit. 

3. She applies two layers of randomization on each logical input qudit: a random sign on each 
of the physical qudits, the same sign key is reused for all the different logical qudits, and a 
random Pauli rotation (different for each logical qudit). 

4. Bob performs the computation while classically communicating with Alice to implement the 
corrections needed after each measurement step. 

5. Alice receives the final output, undoes the quantum one time pad and the random sign key, 
using updated secret keys depending on the public polynomial-QECC logical circuit and the 
communication with Bob, and checks if it is inside the valid subspace of the code. If not, she 
rejects. 


Lemma 2. The ABE protocol is e-verifiable where e = ^ (based on Theorem 4-1 in and 
ignoring the circuit error probability) where d 2 is the degree of polynomials in the polynomial- 
QECC. The quantum requirement of Alice is to prepare 0{n) states of 0{l/log{€)) entangled qudits 
of 0(1/log{e))-level and the communication requirement is 0{n) states of 0{log{l/e)) entangled 
qudits sent from Alice to Bob off-line and 0{n) x 0{log{l/e)) bits of on-line classical communication 
between Alice to Bob, where n is the size of the computation. 

The degree d 2 of polynomials used in the polynomial-QECC will be referred to as the security 
parameter of the ABE protocol in the rest of this paper. 

2 Main results 

We propose a new verification protocol that combines the techniques of the FK and ABE protocols. 
The main idea is to use the verifiable computation of the FK protocol to prepare on the prover’s 
side the inputs encoded by the randomised polynomial QECC, that is, the states Alice would have 
to prepare and send in the first step of the original ABE protocol. On these states the public 
logical circuit of the ABE protocol is applied and the output is tested for being in the correct 
encoded subspace. If either of the trapification or decoding procedures fails, the verifier rejects. 
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The partitioning of the underlying resource state used in the FK protocol into smaller sub-states 
for each separable logical qudit leads to an improved communication complexity of the hybrid 
protocol compared to the original FK protocol. 

In Section 2.1 we give an overview of how the FK protocol is modified for the needs of the 
preparation of the encoded state of the ABE protocol. Section 2.2 examines the problems of incor¬ 
porating the computation and detection procedures of the ABE protocol into the hybrid protocol. 
In Section 2.3 we overview the hybrid protocol and how it achieves its improved complexity. The 
full description of the results is given in later sections and the detailed technical proofs are all in 
the Appendix. 

2.1 Modifying the FK protocol for remote state preparation 

We use the main detection and amplification technique of the FK protocol to remotely prepare the 
state needed for the ABE protocol on Bob’s system. Due to blindness, Bob does not learn anything 
about this state and therefore any secret random parameters it contains, including a quantum one- 
time-pad with a key selected by Alice. The requirement for this state to be useful for the detection 
procedure of the ABE protocol is that it can be written in terms of the correct encoded state up 
to an arbitrary CPTP-map which does not depend on the secret parameters. We call such states 
verifiable states. 

Two problems had to be tackled in modifying the EK protocol for this purpose. The first problem 
is that in the FK protocol, it is impossible to help the server distinguish the computational output 
systems from traps and dummies without jeopardizing the FK protocol’s verifiability. We therefore 
construct a simple protocol to blindly transform the output of the FK protocol to the input that 
contains only the computational output system at a fixed position. Hence, Bob can apply the ABE 
protocol logical circuit on the output state while not learning anything about the trap qubits. 
Secondly, since the state at the end of the preparation phase does not contain any traps there is 
no possibility to test for the correctness of the output. However, since we only require a relaxed 
variant of verifiability (correctness up to a fixed CPTP map) this is proved not to be a problem by 
modifying the original proof of verification. The modified protocol with the localisation gadget we 
call the localising protocol. 

Sketch of the localising protocol^ 

1. Alice and Bob follow the same steps as in the FK protocol, but an extra ‘gadget’ state 
(depicted in Figure[^ is attached on the output system qubits of the entangled state prepared 
by Bob for the original FK protocol. This gadget state does not contain any dummy or trap 
qubits on its final layer therefore effectively fixing the position of the output. 

2. After all qubits of the normal entangled state are measured and the traps are tested Bob is 
asked to measure the remaining qubits in a way that only the output qubits are teleported 
to the last layer. 

3. The state that Bob holds at the end is quantum one-time-padded with a key known only to 
Alice. 


Theorem 1. The output of the localising protocol after decoding of the QECC utilized in the FK 
protocol and decoding of the quantum one-time-pad, averaged over all random parameters of Alice, 
denoted as v, is of the following form: 

^Full protocol is given in Section 4 
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Y.P"ont Pacc£{\^c){^c\) ® \ACC){ACC\ + {l-pacc)p' ® \REJ){REJ\ 

V 

where e = ^ for some c > 1 and d the number of errors corrected by the FK protocol QECC, 
Pace is a probability, |'0c) is the correct output of the computation, S is a CPTP-map where all 
Kraus operators are Pauli operators and is independent of \'tpc) and p' is a normalized state. 

It is important to note that using only a blind quantum computing protocol, without inserting 
any trap qubits for verification, one could not obtain the above required correct form for the final 
output system. In particular the possible cumulative perturbations that Bob may cause may be 
correlated to the state they act on, hence may not be expressible as a fixed CPTP map. 

2.2 Incorporating the verification procednre of the ABE protocol 

As mentioned before, in the hybrid protocol, Bob does not return the state to Alice after the 
localising protocol but he applies the polynomial-code logical circuit to implement the actual com¬ 
putation on the encoded state. In order to incorporate these extra steps we have to resolve a number 
of problems. 

Firstly, the state that Bob holds is encoded by the QECC used for the amplification of the 
detection probability in the FK protocol. In order to apply the logical circuit of the ABE protocol 
on this state we need to ask Bob to decode the first QECC. Fortunately the QECC of the FK 
protocol is based on a stabiliser code with a Clifford decoding circuit [22]. The decoding circuit is 
publicly known and there is no need for any communication between Alice and Bob. An honest 
Bob performs the operators and Alice simply updates her quantum one-time-padding secret keys 
accordingly. Hence no information is leaked on the secret keys, also uniformity of the keys is 
preserved. 

Secondly, the ABE protocol requires quantum states of prime dimension q where q > 2, whereas 
the original FK protocol uses qubits. To resolve this we present an analogue of the FK protocol 
which can use systems of any dimension while preserving all the security properties. The resources 
requirement for Alice is the same, the ability of preparing random single qudit states and the overall 
communication complexity remains the same as the original FK protocol. 

Thirdly, since the computation we use from the ABE protocol is based on gate teleportation, 
there is a constant number of rounds of classical communication between Alice and Bob per non- 
Clifford gate teleportation. We prove, however, that this communication does not leak any of the 
secret parameters of the trapification phase, crucial for the security of the hybrid protocol. 

Finally, we prove since the detection and decoding procedure that Alice applies to the returned 
state of the ABE protocol is a CPTP map, the resulting state of the overall protocol is e-close to 
the hnal state of the ABE protocol, thus also verihable. 

Therefore we have the necessary tools to build a hybrid protocol by incorporating in the prepara¬ 
tion stage (with the localising gadget) the application of the decoding part so that the assumptions 
of Theorem can be modified to arrive to the desired verification property. However this protocol 
would not yet give any improvement in terms of complexity over the existing protocols and to 
achieve this an extra step has to be employed as we describe next. 

2.3 Hybrid Protocol 

We partition the underlying entangled state necessary for the FK protocol phase of the hybrid 
protocol into smaller separable sub-states preparing each a polynomial-QECC encoded input state 
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of the ABE protocol. Since the quadratic round complexity of the FK protocol comes from the 
complex structure of the overall required underlying resource state, simplifying the state for the 
purposes of this hybrid composition (observing that the polynomial-QECC encoded logical inputs 
are separable) succeeds in reducing the communication complexity. This modification does not 
violate the verification properties of the FK protocol since the fact that the states are separate is 
public knowledge and the detection and encoding procedures for each of the separate states can be 
done locally. The sketch of the hybrid protocol is given below: 

Sketch of the FK-ABE hybrid protoco|^ 

1. Alice and Bob execute a specified number of instances of the qudit analogue of the FK 
protocol (that includes the localising gadget) to prepare in Bob’s system each of the desired 
polynomial-QECC state of the ABE protocol. 

2. Bob applies the publicly known Clifford decoding circuit for the QECC used for the amplifica¬ 
tion of the error detection probability of the FK protocol, and Alice updates her one-time-pad 
keys. 

3. Alice and Bob apply the polynomial-QECC logical circuit on the encoded states following the 
steps of the ABE protocol. Alice updates her one-time-pad keys. 

4. Bob sends the final measurement outcomes to Alice and Alice employs the detection and 
decoding procedure of the randomised polynomial-QECC (which is the final step of the ABE 
protocol as well). 


Theorem 2. Hybrid protocol is correct and e-verifiable, with e < ei + e 2 where ei = ^, 62 = ^ 
where di and d 2 are the security parameters of the FK and ABE protocol phase of the hybrid 
protocol respectively and c> 1 is a parameter of the FK protocol phase. Alice needs only to prepare 
random single qudit states and the required classical and quantum communications is of order 
0{nPolylog{^)), where n is the size of the computation. 

The steps which are essential for the construction of this protocol can potentially be used for 
constructing different hybrid schemes. 


3 Preliminaries 


The FK protocol is defined in the measurement based quantum computing model (MBQC), basic 
elements of which are outlined in Section 3.1 The ABE protocol is a d-level quantum system 
protocol with d > 2 and is based on the Gate Teleportation Model outlined in Section 3.2 Finally 


the Quantum Error Correcting Code used in the ABE protocol is given in Section 3.3 


3.1 Measurement Based Quantum Computing 

We introduce the notation necessary to describe a computation in MBQC |23l I24j . A generic 
computation consists of a sequence of commands acting on qubits: 

• Ni{\q)): Prepare the single auxiliary qubit i in the state \q); 

• Eij: Apply entangling operator cZ to qubits i and j; 


*Full protocol is given in Section 5 






• M“: Measure qubit i in the basis {:^(|0) +e*“|l)), ;^(|0) — e*“|l))} followed by trace out the 
measured qubit. The result of measurement of qubit i is called signal and is denoted by Sj; 

• : Apply a Pauli X oi Z correction on qubit i depending on the result Sj of the 
measurement on the j-th qubit. 

The corrections could be combined with measurements to perform ‘adaptive measurements’ denoted 
as = m\ ^ computation is formally defined by the choice of a finite set V of 

qubits, two not necessarily disjoint sets I C V and O C V determining the inputs and outputs, and 
a finite sequence of commands acting on V. 

The entangling commands Eij define an undirected graph over V referred to as {G, I, O). Along 
with the pattern we define a partial order of measurements and a dependency function D which is 
a partial function from to where V denotes the power set. Then, j G if j gets a Pauli 
X correction depending on the measurement outcome of i and j G Df if j gets a Pauli Z correction 
depending on the measurement outcome of i. A sufficient condition on the geometry of the graph 
state to allow unitary computation is the existence of flow ([25]). In what follows, x ~ y denotes 
that X is adjacent to y in G. 


Definition 3. f2^ A flow (/, for a geometry (G, I, O) consists of a map f : E and a 

partial order ^ over V such that for all x G O'’ 

(FO) X ~ /(x); 

(FI) X < f{x); 

(F2) for all y ^ x,y ^ f{x): x <y . 

3.2 d-level quantum operations and gate teleportation model 

First we describe the d-level generalized gates that will be useful in the following constructions. 
All additions and multiplications in these definitions are performed modulo d, unless otherwise 
stated. The generalized Pauli operators over are defined as: X\a) = |a + 1), Z\a) = where 

ujd = is the primitive dth-root of unity. The generalized Hadamard (or Fourier) gate F is 

defined as: 


a) I—7- 


1 

y/d 


bSFd 


The cX is defined as: \a,b) i— \a,a + b) and cZ as: \a,b) i—>■ u!f^\a,b). The generalized phase gate 
S is defined as: 


(a + l)a, 

|a) I—>• \a) 

The generalized Toffoli gate which complements the set of Clifford gates to provide universality 
(|26|, m ) is defined as: |a,6, c) i—)■ |a, 5, c + a6). An alternative to the Toffoli gate to complement 
Clifford gates for universality is the family of ‘so-called’ generalized ‘tt/S’ gates [261 one of which, 
used in this paper, is defined as: T|a) = |a) with the exception of qutrits where Tala) = 

(a® mod 9) i , 

Wg »• 

In the gate teleportation model the ABE protocol is defined in, all Clifford gates are performed 
by applying unitary operators, while the non-Clifford gates are performed by entangling with magic 
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non-Clifford states (Toffoli states in the case of the ABE protocol), measuring in the computational 
basis and performing Clifford correction operators on the remaining states [28]. 

3.3 Polynomial Quantum Error Correcting Code 

The class of quantum error correcting codes used in the ABE protocol, is based on polynomial 
error-correcting codes |29|. By randomizing these codes using a secret sign key one can acquire 
a Quantum Authentication Scheme (QAS) [30|, usable by two parties who want to authenticate 
a quantum state exchanged through a malicious quantum channel. Due to specific properties of 
the signed polynomial error-correcting codes, they can also be used in the context of secure quan¬ 
tum multiparty computation m and in the context verification of a single quantum prover as 
demonstrated in the ABE protocol. 

Specifically, the code operates over the field F^, where d is prime and represents the dimension 
of the quantum system. The code uses polynomials /(•) with coefficients from and with a 
maximum degree of p, where p is a parameter of the code. These polynomials are evaluated at m 
distinct non-zero points from F^: {ai... am}. To be able to choose m distinct non-zero points from 
Erf we impose the restriction: m < d. Moreover, we set m = 2p 1. Finally, the code uses a secret 
sign key that is a uniformly randomly chosen string k •(— {±1}™. 

Given a quantum state |a), where a G F^, we can encode it using the signed polynomial error- 
correcting code: 


V¥ 


E 


) kmf{am)) 


{/Meg(/)<p,/{0)=a} 


mod d) 


where the mod d is taken element-wise in the label of the right-hand side ket. 

To detect if there was any Pauli error in the transmitted codeword, the receiver undoes the sign 
key and checks if the resulting string is the representation, at m distinct points, of a polynomial of 
maximum degree p. If not it aborts and declares the state invalid. The probability of accepting an 
incorrect state (when the channel applies an arbitrary Pauli attack) is exponentially small on p. In 
order to acquire the same property for any type of malicious attack, an extra quantum one-time-pad 
is added on top of the existing randomization, as it is the case in the ABE protocol. 


4 Localising Protocol 

In this section we give an explicit description of the localising protocol. The core methodology is the 
same as in the FK protocol. Each trap is prepared in state l+eQ, where 0 is chosen at random from 
angle set A = {0, vr/d, 27r/4,..., Tvr/d}, and placed at position t in the graph. Positions t are such 
that for the graph used in the FK protocol there exists a partitioning into sub-graphs S-y that the 
each trap is placed at a uniform random position inside each S-y. In the FK protocol the graph that 
is used to achieve this property is the dotted-complete graph |5|, while other graphs can possibly 
satisfy the same property. In order to separate the qubits participating in the computation and the 
trap qubits, dummy qubits prepared in the computational basis are placed between them so that 
the corresponding entangling operators have no effect. The choice of the basis for each dummy state 
is uniformly random to satisfy the blindness property. In particular, if a dummy qubit is in state |0), 
applying the entangling operator cZ between this qubit and a qubit prepared on the (A, Y) plane 
has no effect. If a dummy qubit is in state |1) then applying cZ will introduce a Pauli Z rotation 
on the qubit prepared on the (A, Y) plane. This effect can be cancelled by Alice in advance, by 
introducing a Pauli Z rotation on all the neighbours of |l)’s when preparing the initial state. 
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Protocol 1 Localising Protocol (based on the FK protocol) 


Alice’s input. Description of a computation in the MBQC model (or equivalent) using a convenient 
underlying open graph state {G,I,0). The computation is represented, for any qubit i G G\0, 
as a measurement angle ipi (together with the set of X-dependences Df and Z-dependences D? 
and a fixed partial order of measuring depending on the graph structure). The input is set to be 
the Hadamard basis state of n qubits: |+)®"'. Protocol can be extended to admit external quantum 
input by applying the techniques described in the FK protocol. 

Bob’s output. A quantum state that contains the encoded and one time padded quantum output 
of the computation. 

The protocol 

1. Preprocessing 1. Alice translates the computation to a Fault Tolerant (FT) MBQC pattern 
that can detect d errors. Let the updated open graph be (G',/',0'), where |G| = m! and 
\r\ = \0'\ =n'. 

2. Preprocessing 2. Alice embeds the encoded computation pattern into a suitable graph which 
has the following property: There exists a fixed order of measurement which respects the 
computational flow and each computational qubit belongs to a constant size subset of qubits 

in which a trap can be at any position with uniformly random probability. An example is 
the dotted complete graph of size 0(m'^). 

3. Preprocessing 3. Alice attaches a gadget graph (Figure on each subset of qubits of the 
output system of the previous step’s graph. The effect of these extra graphs is that they fix 
the position of system O'. The total number of qubits of the final graph is N. 

4. Alice prepares the rotated qubits. For i = 1 to N: 

(a) If qubit is a dummy: prepares \di), di •(—{0,1} (where •(—means chosen uniformly at 
random from). 

(b) If qubit is not dummy and not in O': prepares ^ where I+ 0 Q = 

^ (10) + e*®* 11)), {0, vr/d, 27r/4,..., Zvr/d}. 

(c) If qubit is in O': Same as previous step but 9 is fixed to 0 and an extra rotation is 
applied where r* is a random bit. 

(d) She sends the qubit to Bob. 

5. Bob entangles the states according to the graph state by applying cZ gates. 

6. Bob performs the rest of the computation using classical help from Alice. For i which ranges 
over all qubits (respecting the flow) except system O': 

(a) Alice computes the actual measurement angle 4>i using the dependences and the previous 
measurement results {(fi = 0 for dummies and traps). 

(b) Alice chooses a random bit r* and computes 6i = (f>'^ + 9i + irri. 

(c) Alice transmits 8i to Bob. 

(d) Bob performs measurement on qubit i. 

(e) Bob transmits the result to Alice. 

(f) Alice flips the result if r* = 1, otherwSsb does nothing. 

7. Alice sets her indicator bit to accept if all trap tests where successful. 




During the execution of measurement based computation Bob is asked to measure the trap 
qubits, at positions t € T, each with angle 9t + rvr and return each classical result bt to Alice. If for 
all trap qubits t € T we have bt = rt Alice sets an indicator bit to state acc (which means that this 
computation is accepted), otherwise she sets it to rej (computation is rejected). Due to blindness 
(achieved by the random rotations) the prover cannot learn the position of traps so he is not able 
to return with probability one the correct results of the trap measurements while deviating from 
the steps of the protocol. The computation is encoded in a fault tolerant procedure using a QECC 
that can perfectly correct d errors, so dishonest prover has to attack at more than d positions, thus 
having exponentially small in d probability of succeeding in predicting the correct results of the 
corresponding traps. 



Figure 1: Single gadget state attached to a subset (represented by dashed circles) of the output 
of the normal graph used in the FK protocol. The number of branches depends on IS'.yl. Only one 
of the qubits of the first row of the gadget is a non-dummy state allowing to teleport blindly the 
actual output to the bottom qubit. 


The main difference from the original FK protocol is the modification of the graph state by 
appending on the output a specific number of gadget states, one of which is depicted in Figure 
Specihcally one gadget is attached on each subset of the output of the FK protocol graph (system 
to be normally returned to Alice). Following the construction in the FK protocol, we assume that 
each contains one trap qubit, a number of dummy qubits and one qubit participating in the 
actual computation (in the dotted-complete graph based version of the FK protocol V 7 , = 3). 

The goal of the gadget system is to teleport only the computational qubit to the fixed vertex at 
the bottom of each gadget. Therefore the first layer of the gadget qubits (in Figure the first 
row of solid circles, that are connected directly to the existing graph of the FK protocol) contains 
— 1 dummy qubits which isolate the trap and the dummies of the output S^y from the bottom 
qubit. The computational qubit and the gadget qubit that is connected to it are both measured 
with (f> = 0 so that the effective computation is identity and the qubit is teleported to the bottom 
of the gadget. The gadget structure is such (one gadget per Sy and symmetric) that they can be 
added without breaking the uniformity of the positioning of the traps in the FK protocol graph. 
The steps of the localising protocol are given in Protocol 

A sketch of the proof of verifiable state preparation, formally described in[^ is given here, while 
a detailed proof is presented in Appendix 

The following lemma will be used in the proof: 


Lemma 3. (Channel twirling ]32() 
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PiQPrpPiQ'Pi = 0 , ifQ^Q' 


( 4 ) 


i 

where p is a matrix, Q, Q' are two arbitrary general Pauli operators of the same dimension, 
and {Pi} is the set of all general Pauli operators of dimension same as Q and Q'. 

Extra notation has to be introduced first. Vector u is used to represent all random secret 
parameters chosen by Alice throughout the execution of protocol, including r = {rj}, 6 = {9i}, 
d = {di} and positions of traps t = {tj}. Parameter p{v) gives the probability of a particular choice 
of random secret parameters. Summing over a vector (e.g. 'Yhr) that we sum over all possible 

choices for the elements of that vector (e.g. all possible bit-strings of size N for r). 

For convenience we denote some of the subsystems of the joint Alice-Bob state: 


• System Ai contains the qubits of the graph state that participate in the computation and are 
measured. 


• System D contains all dummy qubits. 

• System T contains all trap qubits. 

• System O' is the fixed output system (therefore all the bottom qubits of the gadget states - 
which are the only that are not measured). 

• System A is the system of the measurement angles send by Alice to Bob, where each angle is 
represented by three qubits in the computational basis. 

• System B is Bob’s private system, assumed to be initially in the blank state. 


Proof Sketch of Theorem (Preparation of verifiable states by the localising protocol.) We fol¬ 
low a single index convention to enumerate the qubits participating in the graph where N is the 
total number of qubits and the last n' qubits are the qubits which are not measured (system O'). 
While in Protocol [^system O' remains to the hands of Bob, to be used for the next phase of the hy¬ 
brid protocol, to prove the property of Theorem we have to assume extra steps of Alice receiving 
and decoding the output state. As it will be made clear in the next section, the same property is 
true in the case Bob applies an extra Clifford circuit, which is needed in FK-ABE hybrid protocol, 
before returning the state to Alice. 

Honest computation includes global entangling operator Eq (Step on the received state 
\M{6,d,t)) (all qubits sent at Step|^ and for each l<i<N — n'a. measurement, described in 
Step 6d, with outcome G {0,1}. This measurement can be analysed into unitary part HiRi{6i), 
where Hi is the Hadamard gate and Ri{.) is rotation around 2 ;-axis on qubit i which depends on 
measurement angles 6{6, r, b) (where b = {bi)i), and a Pauli Z measurement on qubit i (projectors 
\bi){bi\). Without loss of generality we can represent any dishonest behaviour of Bob at any step as 
applying the correct unitary operators and then an arbitrary unitary attack operator which applies 
also on his private system assumed to be in state |0)®^. 

After trivial commutations, the output of Protocol with extra steps of Alice receiving system 
O' and applying decoding map P for the FK protocol QECC and final Pauli corrections C{r,b), 
which include output system corrections Cq' and trap results corrections by rt, can be written as 
(note that we omit the dependences of each operator in the formula for the sake of brevity): 
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Pout = TrsMA^Y. • • • HiRi{.)Eg{ 

h V 

\M){M\ ® \d){S\)EGRi{.)^H,... ® \0){0\^^)U^\b){b\)C^) ( 5 ) 

where U is the global (commuted) unitary attack operator that is chosen by Bob and applies 
on system AixO'xDxAxB. 

Tracing out system B, attack U {U^) is transformed to a Completely Positive Trace Preserv¬ 
ing (CPTP) map acting on the remaining system. We can write the CPTP map in the Kraus 
decomposition and express the Kraus operators in the Pauli basis (all possible tensor products 
of single qubit Pauli operators). Moreover, applying the part of the honest unitary operation 
for each trap (entangling with its neighbour dummy qubits and HtRt{5t)) results in the system 
of traps T being disentangled from the rest. The remaining unitary operators are denoted by 
V' = H-n’R n- n' {■) ■ • ■ HiRi{.)Eq and the remaining system that they apply to is denoted by 
\M'). 


Pout = ak,u,valyyCo’V{\y){b'\Pu\ry/j,i^tj ® Pv 

b v k^u^v^u' ,v' 

® +rij)) (6) 

i 

where 

• ak,u,v are complex numbers, with Y^k,u,v \(^k,u,v\‘^ = 1- 

• Pu (and Pu') ranges over all tensor products of Pauli operators on the system that is trapified: 
all qubits of system Ai x D xT except the qubits that belong to the gadget and are measured 
(first row of each gadget). 

• Pv (and Pyi) ranges over all tensor products of Pauli operators on the system that is not 
trapified: all qubits that belong to gadget systems and the measurement angle system A. 

• P„|j is the i-th Pauli element of Pu- 

• b' is the vector that is generated from b by removing elements {bt^}- 

So far, the analysis followed similar techniques to verifiability proof of the original FK protocol. 
However the following steps have to be introduced to take care of the issues of using the extra gadget 
state and not having traps on the final output state (therefore proving the relaxed verification 
requirement). 

Summing over random parameters 6, d and r and tracing over systems A, D and Ai respectively 
enables us, with the aid of Lemma to eliminate all terms where Pu\i / Pu’\i and Pv\i / Pv>\i 
which reduces the attack of Bob on the remaining state (where all dependences on these 

random parameters is eliminated - corrections on the output are also updated accordingly to Cq,) 
to a convex combination of Pauli operations. 
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(7) 


pout — \(^k,u,v\‘^CQ,'D{{b'\ 

b t k,u^v 

i 

where O" is the system that contains the qubits of all gadgets. 

We split the terms of the sum over the attack operators Pu into the terms which are determin¬ 
istically corrected by P and the terms that are not corrected by P but with high probability will 
have an effect on the trap measurement outcomes signifying that an attack has happened. 

Specifically, we first examine state ui which comes from pout by restricting summation to u G 5i, 
where 5i is the set of tensor products of Pauli operators that contain < d elements with Pauli X 
component {d is the number of correctable errors of the code). Attacks Py\o" on the output gadget 
can be rewritten as Pauli attacks on the output state O' that are not correlated on the state 
itself. This is possible only because Pauli attacks on the last measurement layer of MBQC can be 
translated to corrections on the output, which is not the case for attacks on any layer. Moreover, 
attacks Pu\rMj,i^tj be perfectly corrected when applying P, since their footprint is < d, giving 
correct output state {tpc)- Separating the attacks to those who have an effect on the trap system, 
causing Alice to set her indicator bit to \REJ), and those who do not touch any trap (and therefore 
Alice accepts) we get: 


® \ACC){ACC\ + Y,P'jPj\^c){^Pc\Pj ® \REJ){REJ\ (8) 

* j 

where Pi {Pj) range over all tensor products of Pauli operators on the output system O and 
p'i,Pi are probabilities, with '£M+Pi) = J2k,u&Si,v W,u,v?- 

Let state a 2 include remaining terms of the summation over u in Equation where u £ S 2 
corresponds to Pu where > d Pauli elements have Pauli X component. 

We calculate the probability the state collapses to the ‘incorrect’ subspace P± = I — |'0c)(V’c| 
and all the trap measurement outcomes returned are correct. Since Bob has to guess the output of 
the trap measurement at, at least, d positions, where the traps can be placed with probability that 
depends on the amount of traps in the graph, the probability of cheating successfully is exponentially 
decaying in d. 


rr(P^(g)|0),(0|,^72)<y(V^ 

i 


(9) 


where c > 1 is a constant that depends on the ratio of total qubits and traps in the graph. 
Therefore state ct 2 can be written as: 


® \ACC){ACC\ +P2P®\REJ){REJ\ (10) 

where e = \/ (1/c)'^, pi and p 2 are probabilities with pi -|- P 2 = Ylku&S 2 v \^k,u,v\‘^ and p is a 
density matrix. 

Summing again the terms cJi and 1 T 2 , theorem is satisfied for e = 

□ 
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5 Hybrid Protocol 


The proposed FK-ABE hybrid protocol combines all the techniques discussed so far, including the 
partitioning of the high complexity resource state of the FK protocol to sub-graphs, each used for 
the preparation of a separate encoded state for the ABE protocol, thus reducing the quantum and 
classical communication complexity. 

The protocol, described here as Protocol is based on a d-level version of Protocol for d odd 
prime, which corresponds to the following changes: 

• The state is entangled by applying generalized cZ gates. 

• Alice’s states l+ej are replaced by states ;^(|0) + ... + |d — 1)), where T are gener¬ 

alized ‘tt/S’ gates, S generalized phase gates, Z generalized Pauli Z gates and a*, bi, Ci 
(except qutrits, where T gate is replaced by T 3 gate and c* Eg). 

• Dummy states are generalized computational basis states |dj), di ^r 

• Measurements on vector (a', 6 ',c') G correspond to generalized measurements on basis 
{Z^T^iS^iZ°'i^{\0) -b ... -b |d — l))}j=o- Measurements vectors are corrected to incorporate 
generalized Pauli X and Z corrections |33j . |34j according to flow dependencies. 

• Alice cancels the pre-rotation by adding [ai,bi,Ci) on her (corrected) measurement vector. 
In the measurement vector she sends to Bob, extra term (rj,0,0)^, rj ^r F^ is added to 
randomize the output of Bob’s measurement. She corrects the measurement result she receives 
from Bob by adding r*. 


Correctness of the d-level version of the FK protocol follows the same argument of the correctness 
of qubit case, applying d-level MBQC [33],[31] and noticing that the d-level dummy qudits have 
the same effect as in the qubit case. Universality comes from the fact that we are able to perform a 
universal set of gates for d-level computation: {cX, F, S, T, Z} [26], with the special case of qutrits 
where T becomes T 3 . 

A sketch of the proof of verifiability of Protocol[^is given here, while a detailed proof is presented 
in Appendix [B| 

We use the same notation as in the proof of Theorem to denote the different subsystems, 
however there is a new subsystem denoted by L that contains the corrections sent from Alice to Bob 
for the Toffoli gate implementation at the ABE protocol phase. System Xi still contains the qudits 
of the graph state that participate in the computation and are measured during the application of 
the FK protocol stage but not the qudits that are measured during the ABE protocol phase. 


Proof Sketch of Theorem 
niques to those in Theorem [T 


^ (Verifiability of FK-ABE hybrid protocol). We employ similar tech- 
to write the state of Alice, before applying the detection mechanism 
of the ABE protocol, as a verifiable state, for any choice of the random sign key and without leaking 
information about it. 

The extra elements that FK-ABE hybrid protocol introduces, compared to the localising pro¬ 
tocol, include the measurements needed for the implementation of the Toffoli gates, with outcomes 
bi ^ Yd sent from Bob to Alice and corrections G F^ sent from Alice to Bob. The Clifford circuit 
that implements the logical public circuit of the ABE protocol is denoted by C and applies on the 
decoded for the FK protocol QECC output system O and on the corrections system C. Final Pauli 
corrections C”{r, b, b) for Alice, here, take also into account the update due to the application of C 
and include output system corrections Cq, and trap results corrections by rt- Note that the qubit 
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Protocol 2 FK-ABE Hybrid Protocol 

Alice’s input. Description of a computation in the Gate Teleportation model based on generalized 
Toffoli states. The input is set to be the Fourier basis state of n qudits: |+o)®”, where |+o) = 
I®)- total number of gates is denoted by t. Protocol can be extended to admit arbitrary 
quantum input using the same methods as in the FK protocol. 

Alice’s output. The result of measurement of the quantum output of the circuit and a bit indi¬ 
cating if the result is accepted or not. 

The protocol 

1 . Alice chooses a single random sign key (of size equal to the size of a codeword) that will be 
used to encode all inputs (including Toffoli states) according to the signed-polynomial QECC. 

2 . A d-level Eault Tolerant QECC is selected for amplification of the detection probability of 
the FK protocol. 

3. Alice has to remotely prepare the Toffoli states and to encode both the inputs and the Toffoli 
states according to the ABE protocol QECC randomized by the selected sign key. For each 
encoded state she selects a separate graph state that has the properties described in Protocol 

Therefore, the size of each sub-graph depends only on the security parameters of the 
protocol and not on the size of the computation t. 

4. Alice and Bob encode all inputs (including Toffoli states) by executing Protocol adapted 
for d level systems. The output of Bob is encoded by the QECC used for amplification of the 
FK protocol and the final quantum one time pad, which depends on the secret parameters 
of the FK protocol and will referred to as the Pauli key. Alice holds an indicator bit set on 
accept or reject depending on the outcome of the traps. 

5. Bob applies the Clifford circuit for decoding the QECC used for amplification of the EK 
protocol and Alice updates her Pauli keys accordingly. 

6 . Alice and Bob perform the logical operators that correspond to the desired computation on the 
encoded by polynomial QECC state as described in the ABE protocol. Eor each application 
of logical Toffoli gate. Bob sends measurement results to Alice and Alice calculates the actual 
correction to be performed on the state and sends it to Bob who performs it. 

7. Bob measures the output qudits in the computational basis and returns the measurement 
results to Alice. 

8 . Alice applies the detection and decoding procedure of the signed polynomial QECC and sets 
a second indicator bit accordingly. 

9. Alice accepts if both indicator bits of the FK and ABE protocol phase of the protocol are set 
to accept, otherwise she rejects. 
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gates have been replaced by their d-level analogues. To highlight the analogy with the qubit case 
we keep the same notation of the measurement vectors: 6, 0 and S, noting that they are dit instead 
of bit triples. We can, therefore, write Alice’s final output before the detection mechanism of the 
ABE protocol phase as: 


Pout = TrB,A4,A,D,£(^ ® \b){b\UCV{FM-n'RN-n'{-) • • • FiR,{.)Eg{ 

b,b 

\M){M\ ® |d)(5|)EGi2i(.)tFt... ® |0)(0|®^ ® \r){7\)V^\b){b\ ® |b)(6|)C")(ll) 

where U represents global (commuted) Bob’s attack that in this case applies also on system C. 
Similarly to proof of Theorem Alice’s output can be rewritten as: 


Pout = TrM,A,D,cC^'^Pi^) 0.k,u,valyyC'l),{\b'){b'\ (g) |h) Pv 

bTf ^ k,u,v,u\v' 

CV{V'{\M'){M'\ ® ® Pu'\b'){y \® \b)(b\)cS, 

® l&q +nj)) (12) 

i 

where the only difference from the proof of Theoremis that the attacks Pu (and Pu'), Pv (and 
Pyi) are tensor products of d-level Pauli operators and that P^ (and P^,/) applies also on system C. 

Again, summing over random parameters 0, d and r and tracing over systems A, D and Ad 
respectively enables us to reduce the attack on these systems to a mixture of Pauli operations. 
Special care has to be taken for the attack on system L which can be reduced to Pauli operators by 
exploiting the structure of the Toffoli implementation circuit, where all logical measurements have 
uniformly random results, and, therefore, an extra logical Pauli X randomization can be extracted. 
Tracing out the system L as well results to: 


pout — \ak,u,vfC^o'(.i^'\ ® \^){^\Fu\i:\/jMt, ® Rv\o" 

5 5 t k,u,v 

i 

The next step is the splitting of the internal sum (over u) into two parts, yielding two sub¬ 
normalized states (Ti and <72. In cji we restrict the index u to the set ^i, which contains all attacks 
which are corrected by the FK protocol QECC, with parameter di, and in (T 2 to u G S 2 which 
contains attacks with Pauli X footprint > di and therefore will activate at least di traps when 
averaging over all positions for the traps. The only difference here from the proof of Theorem is 
the existence of the public circuit C, but since it applies only on system O it does not affect the 
probabilities of detecting the traps and since it is Clifford the Pauli corrections commute with it 
and get updated secretly by Alice. Again: 


(Ti = 


® |AC'C'i)(ACCi| + Y,PjPM){^c\Pj ® \RER){RER\ (14) 
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where is the correct state after the ABE protocol phase is performed and the quantum 

one time pad with the Pauli key is undone. Also Pi [Pj) range over all tensor products of d-level Pauli 
operators on the output system O and p'iip'l are probabilities, with Yliip'iPp'l) — u^S\ v \(^k,u,v\‘^- 
Also, since the same counting arguments hold for the d-level traps on the measured system: 


<72 pMi^cl ® \ACCi){ACCi\ +p2P®\REJi){REJi\ 


(15) 


where ei = V(l/c)‘^i, pi+p 2 = J 2 k,u&S 2 ,v Wk,u,v\‘^ and p is a density matrix. 

By adding the states described in Equations 14 and 15 and by contractiveness of the ABE 
protocol detection procedure that Alice applies to check if the state is in the valid space of the 
signed polynomial QECC, theorem is satisfied for ei = (l/c)'^i and 62 = {1/2)'^'^, where d 2 is the 

degree of the polynomials in the QECC used in the ABE protocol. 

□ 


In the FK-ABE hybrid protocol the quantum requirement for Alice is to prepare single qudit 
states of the form , for o^, bi, Ci <—ji F^, where d is an odd prime. The dimension d of 

each system is 0{l/log{e)). Alice has to send to Bob, at the beginning of the protocol before getting 
the computation description, 0(nPolylog(^)) separable single qudit states, where n is the size of the 
computation. After, Alice and Bob have to exchange only classical information in 0(nPolylog(^)) 
rounds, where each round includes a constant size message sent from Bob to Alice and a constant 
size message from Alice to Bob. 
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A Proof of Theorem [I] 

Single index notation is followed to enumerate the qubits participating in the graph where N is 
the total number of qubits and the last n' qubits are the encoded output qubits (system O'). Each 
measurement performed at Step |6d| of the protocol is analysed into a unitary part and a Pauli Z 
measurement. Without loss of generality we can represent any dishonest behaviour of Bob at any 
step as applying the correct unitary operators and then an arbitrary unitary attack operator. 

The output that Alice produces after she receives system O' from Bob and applies the decoding 
operators, averaged over all random parameters is: 


Pout = TrB,MA,D(y^,y^,Pi^)^'^i\^N-r 
b V 


'){bN-n' \UN-n'HN-n'RN-ni {hN-n'){\hN-n') {^N-r. 


\bk){hk\UkHkRk{dk){\6k){5k\ ® 

... 16i)(6ilUiHii?i(Ji)(lJi)(Jil ® Eg\M){M\ ® lO)(Ol®^EG)i?i(<5i)^HiU|l6i)(6il... 

)Rk{bk)^HkUl\hk){bk\ . . .)RN-n'{bN-n')^HN_^,Ul,_JbN-n'){bN-n'\)C^){lQ) 
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where: 


• \M{6, d, t)) is the state that Bob receives after Stepj^of the protocol (input, auxiliary qubits, 
dummy qubits). 

• Eg is the global entangling operator that Bob applies at step 5 of the protocol. 

• (5(0, r, 6 ) is the vector of 6i{6,r,b) which are measurement angles that Alice sends to Bob at 
iteration i of step 5 of the protocol . 

• Ri{5i) is rotation of qubit i around z-axis by angle 5i. 

• Hi \s a. Hadamard gate applied on qubit i. 

• Ui is the unitary attack of Bob with index i and applies on qubits > i, private Bob’s system 
and all measurement angles. 

• P is the map that Alice applies to decoding for the QECC used in the Fault Tolerant proce¬ 
dure. 

• C{r,b) includes the Pauli correction Cq' that Alice performs to the output system O' and 
the corrections to trap measurement results. 

By commuting all measurement angles (trivially) and all attack unitary operators (by observing 
that they trivially commute with all measurements < i) and merge them into a new unitary U that 
applies on the whole of the system we get (see also Figure]^: 


^f) 


l<)> 


::i> 





Figure 2: Analysis of attacks in the localising protocol. Part inside dashed box is applied by Alice. 


Pout = TtemaMYI • • • HiRi{.)Eg{ 

b y 

|M)(M| ® \6)^6\)EgRx{)^Hx ... i2w-n'(-)^^iV-n' ® |0)(0|®^)C/t|6)(b|)Ct) (17) 
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where U is a unitary attack operator that is chosen by Bob and applies on all graph qubits, 
private Bob’s system and all measurement angles. 

The trap system is not entangled with the rest when the honest computation is applied. We can 
separate the terms that apply on the trap (remember that the trap is placed among the measured 
qubits). Applying the entangling operators between the traps and their neighbours, which are 
always dummy qubits does not have any effect other than undoing the pre-rotation of the trap (for 
the case the dummy is selected to be |1)). Applying HtRt{6t) on each trap, where 6t = 6t + titt, 
results in getting state \rt)- 
Therefore, it holds that: 


iP(|M)(M| ® |^)(<5|)iPt = ® \S){S\)V'^ (g) |n,)(nj (18) 

i 

where 


• V = H]\f_n'RN-n'{-) ■ ■ ■ HtiRt^i-) ■ ■ ■ HiRi{.)Eg is the correct unitary operation in Figure]^ 

• V' = H]\j-n’RN-n'{■)■■■ HiRi[-)E'q, which is produced from V by omitting all operations 
applied on traps {Eq is produced from Eg by omitting all entangling operators between 
traps and their neighbours) 

• |M') is produced from |M) by omitting the trap qubits. 

In the next step we express the output state with Bob’s private system traced out and his attack 
decomposed to the Pauli basis. We use the following general property: 

For any unitary U and re-qubit state p it holds that: 

rrs(C/(p® |0)(0|^)C/t) = ^ ak,ual^,PupPu' (19) 

k,u^u' 


where 


• ak,u are complex numbers, with ^ \ak,u\‘^ = 1- 

• Pu (and Pu') ranges over all general Pauli operators on re qubits. 


Applying this property to the state in Equation [T^ by tracing out system B, and at the same 
time applying Equation to separate the traps we get the following form: 


Pout = TrMARi'^'^Pi’^) (g) Py 

b y k,u,v^u' 

(P'(|M')(M'| ® |d)(5|)P't)P„,|,,v,,*^,^. ® 

+'^k)ih\Pu\u\rti)iPi\Pu'\u\bt,){bt^ +nj)) (20) 

i 

where 

• ak,u,v are complex numbers, with Y.k,u,v Wk,u,v\‘^ = 1- 

• Pu (and Pu') ranges over all general Pauli operators and applies on the system that is trapified: 
all systems that are measured except those on the output gadget. 
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• Py (and Py/) ranges over all general Pauli operators and applies on the system that is not 
trapified: the whole of the gadget system O" and the measurement angle system A. 

• P„|j is the i-th Pauli element of Py 

• y is the vector that is generated from h by removing elements { 6 *^}. 

In the next part of the proof the attack of Bob will be reduced to a mixture of Pauli operators, 
utilizing all random parameters except the random position of the trap to cancel the cross Pauli 
terms that are not the same. 

By observing that Ri{.){\^p) ® |5i)) is equivalent mathematically to ( 8 ) since 6i is a 

classical state we can rewrite 


V' = H]^_niRN-n'{5N-n') ■ ■ ■ HlRl{h)E'G = 

HN-n'RN-n'{4'N-n' + ^N-n' + . . . HiRi{(j)'i + 6i + ri7r)pQ = 

^N—n'R n— n' ■ ■ ■ RlRl {4^1 “1“ —n' i^N—n'') ■ ■ ■ ^N—n' (^i) 

V”RN-n'{GN-n') ■ ■-RN-n'iQi) (21) 

Operations P 7 v-n'(^Af-n') • • • R-N-n'idi) when applied to states |M) (or not applying at all on 
dummies since 9 is 0) they cancel the pre-rotation and the state is updated to a state which does 
not depend on 0, denoted by |M'). 

Now that we have eliminated all dependences on 6 except for states |^) we can sum over 6 to 
get for system A the state Pv\a:^IRv'\a- For Py\A = Pv'\A this has trace 1 and for Py\A / Pv'\A 
it has trace 0, since all Pauli operators except identity are traceless. Therefore we can ignore the 
attack cross terms applied on the measurement angles system. 

Next we consider the dummy qubits. Part of E'q is applied between them and the computational 
qubits cancelling the pre-rotation of the latter when dj = 1. The remaining entangling operators 
will be denoted by Eq. Also for the rest of the operation applied on each dummy i € D: 

^ HiRi{ri7r)\di){di\Riiri7T)Hi) = ( 22 ) 

i 

Again Tr(P„|^^/P„/|^) is 1 for Py^^ = and 0 for so we can ignore the 

cross terms of the attack applying on the dummy qubits. Let \M") denote state \M') without the 
traps and the dummy qubits. 

The next step is an iteration over all qubits i of the graph state and using summation over each 
Vi to twirl each attack operator on qubit f{i) respectively, where / is the flow function. We begin 
from qubit N and follow the reverse measuring order. We distinguish between tree types of qubits 
depending on their placement and we apply a different technique for each one: 

• Qubit i G O': We extract stabilizer Z from graph E'q\M") (assuming that the 
final layer qubits are not entangled between them as it is the case in the graphs we consider 
in this work). This cancels dependence on on the operation applied on qubit 

and allows as to sum over J’z-qi) (and rQ to get property (using Lemmalsj): 


V—> b 

E 


EgZ^X, 


1 

1 



)+0-H 


= 0 if Py\i / Pyl\i (23) 
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Note that for the terms that remain (P^|j = Pv'\i) summing over eliminates all 

dependences from in the formula. Also note that Z-^ terms and all the b 

corrections remain. 

• Qubit i ^ O'Ul: We extract stabilizer Z jy/-i(j) from graph This 

cancels dependence on ?'/-i(j) on the operation applied on qubit and on operations 

applied on qubits {j ^ i,j ^ /~^(*)} (notice that attacks on qubits {j ^ i,j / have 

already been twirled because we follow the opposite of flow). By summing the elements that 
still depend on rj-i(j): 


Tf-l 


{bi\Pu\iHiRi{(pi + rjTr) 


/-bo 


X 




where </>' = (-1)'’/ b0+^/ Hi)^^ + (^/-bi-h/WW) + 
This state is equal to 


(24) 


'■/-bo 

where = (-l)'’/-bO0i + (6/-io-^ij^/(i)) + ry-io-^ij^/(i)))vr. 

To get the above state we used also the fact that we can extract a random Z- ■' from both 
{bi\ and \bi), without affecting the state. 

To apply Lemma [3| we also need the random X elements. These are acquired by extracting 
stabilizer from graph and also changing variable b^ ■(— bi + r'- for 

r' •(—/J {0,1}. The new terms cancel everywhere except at qubit i so that we get: 




r f—i 
f ^ p 


u\i 


,Zy-"X<HiRi{ck'l + ri7r)L;(4(|M(3))(M(3)|)£;; 


'■/-bO’b 


Tf-l 


Ri{<p'' + mT)^HiX<z"P 


Pu'li^i 


'X^^\bt)=0i^Pul^^Pu'\^ 


(26) 


• Qubit i G 7: We use property XR{c/))\+) = e*'^7?(—(;/i)|+) We extract stabilizer X^°Zj°.^ from 

graph Eq\M^^')) (graphs we use have the property that inputs i are only entangled with f{i)), 
where zo •(— {0,1}. Also extract a random Z^° from {bi\ and from \bi) and employing the same 
trick for generating the X elements that we did in the previous step and then applying Lemma 
1 ^ gives us: 


^ {bi\X^°Z^°P^^,Z^°X^^HiR,{4>i + r,7r) 

3^0, 2:0 

77(4(|M(3))(M(3)|)7;^7?i(<))i + ri7r)t77iA"°Z^°P,,|iZ"°X"°|6Q = 0 if (27) 
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Finally we consider the trap qubits tj: 


\bu +ru){bu\Pu\ti\rti){ru\Pu'\ti\bt,){bti + n, 

rt,,bt. 

By changing variable b^. •(— ht^ + rt^ 


(28) 




’bl 


= 0 if Pu\u / Pu'lu 

Thus we have zeroed all terms where u ^ u and v ^ v which gives: 


(29) 


pout — YYp^*^ y \ak,u,v\‘^CQ,V{{b'\ 

^u\vM j^i^tj ® ^v\0" 

h t k,u^v 

(p(3)(|M(3))(M(3)|)p(3)t)p^|.^^.^^^^,^P^I^,,|5'))C3,(g)P (30) 

i 


where 


• \mP'^) is the tensor product of |+) for all qubits of system Xi x O'. 

• is the unitary that contains E'q for Xi x O' and HiRi{{—l)^f~^(^'>4>i + 
operators for all qubits of system Xi. 

• C' are the remaining Pauli corrections on the output system O' (after eliminating the r’s) 
and depend only on b. 


We split the sum over the attack operators P„ (applying on the trapified system) in Equation 
30 into the operators which are perfectly corrected by the QECC used in the FK protocol and the 


operators which are not corrected but have a significant footprint to be caught by the trapification 
procedure with high probability. 

Specifically, restricting the summation in the state of Equation to u G 5i where 5i is the set 
of general Pauli operators that contain < d elements which have a Pauli X component (where d is 
the number of correctable errors of the code), we have state: 


CJl = YYp^^') Y |®fc,u,i;|^C'Q/P(b \Pu 

® ^v\0" 

b t k,u^Si,v 


(31) 


Let us separate the terms of the Pauli attack Py\o" fh® gadget system to those applying on 
the measured qubits, say and those who apply on the output system O' qubits, say 
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The X-component of attack denoted by P^^, can be replaced by a P^^ attack on output 
system O' (since it affects the X corrections of the output) and the Z-component of attack P^^ does 
not have any effect on the state. Note that if we wanted to reduce attacks of previous measurement 
layers to attacks on the output these attacks would have a correlation with the output, but in the 
case of the last measurement layer this does not happen. 

Commuting the output Pauli attacks P^^P^j with the decoding operator V updates them to a 
different Pauli operator : 


b t k,u£Si^v 

i 

Since Pu G 5i attack Pu\r.\/j,ij^tj and the QECC perfectly corrects d errors, the attack will not 
have any effect on the correct (quantum one-time-padded) outcome after applying the measurements 
and decoding. 


= E \<^k,u,vfC'o,PMCo\i^c){^c\C'o,)P'^^^^^ (33) 

b t k,u£Si,v i 

We can further eliminate C'q, by commuting through output attacks. 

By separating the terms that leave all traps untouched and the rest and tracing out O' \0 we 


p = ® |^CC)(Z1CC| + Y,P'jPj\^c){^c\Pj ® |PPJ)(PPJ| 

* i 


(34) 


where 


• Pj (Pj) range over all general Pauli operators on the output system O. 

• Pi,Pi are probabilities with J2M+Pi) = J2k,ueSuv W,u,v? ■ 

• \ACC){ACC\ is the state where all trap qubits are |0)(0| and |PPJ)(PPJ| denotes any state 
that at least one trap is |1)(1|. 

• |V'c)(V'c| is the correct state for the output system O, which crucially is placed on a fixed 
position which does not depend on the selection of the trap positions (t) (since the position 
of O' was also fixed due to the structure of the gadget and the decoding circuit is fixed). 


We examine the rest of the terms of the summation in the state in Equation 30 (where u € S 2 
means that Pu contains > d Pauli elements with a Pauli X component). 

Let P± be the projection to the orthogonal space to the correct output state: 


P± = I - |'0c)('0c 


(35) 


We calculate the ‘bad’ probability pbad the state collapses to the ‘incorrect’ subspace and no 
trap is activated. 
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( 36 ) 


Pbad — TrC£p{t)P^(^\0)tAO\u{Yl E 

t i b k,u£S2,v 

i 

Tracing out 


<TrC£p{tmtA^\u 

t 


E 

k,uGS2,v 


^k,it 


Pu\tMti{o\tiPu\u 


(37) 


Or; 


= nE^(^*) E \(^k,uM‘^\{0\uPu\u\0)tf (38) 

i ti k,u&S2,v 

We can divide the measured positions into |t| subsets S-y where each trap position ty is cho¬ 
sen uniformly at random between the = 1/c' positions (revealing this information can only 
deteriorate the security, so the bound will be true also for the previous case); 

Id 

= n E E \(^k,u,v\‘^\{0\^Pum\0)t-,\‘^ (39) 

'y=lt-y£S'y k,u£S2,v 

Denoting by Wu,'y the number of positions such that (over all 1/c' values that the particular 
ty can take) is either Pauli X or Y: 


= 11 ''' E 

7=1 k,u£S2,v 


^^, 7 ) 


1*1 

<n E 

7=1 k,u£S 2 ,v 


where the last inequality comes from the fact that Wu,-y is non-negative integer. 


(40) 


= E \<^k,u,v\\l - 

k,u&S2,v 

< E Wk,u,vfil-cY (41) 

k,u&S2,v 

where the last inequality comes from the fact that since tt G ^ 2 , it follows that the total footprint 
Wu,^ of attack Pu is > d. 

Therefore state can be written as; 
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( 42 ) 


^2 pi E \ak,u,v\^)\^Pc){^Pc\®\ACC){ACC\ 

k,u&S2,v 

+ {l-p){ ^ \ak,u,v\‘^)p®\REJ){REJ\ 

k,u&S2,v 

for some probability p and density matrix p. Or, 


^2 ~^/(iz^Pi|^c)(V’c| ® |^CC)(^CC| +P2P®\REJ){REJ\ (43) 

where 

• Pl+ P2 = Ylk,u£S2,v \^k,u,v\'^ 

• p is a density matrix. 

Summing the terms ai and <72, Theorem is satisfied with e = (1 — c')'^. 


B Proof of Theorem 

For any run of Protocol]^ for any choice of Alice’s input computation (therefore for any choice of 
sign keys used in the ABE protocol phase), the output that Alice has at the end of the protocol 
before applying the ABE detection procedure, averaged over all random parameters except the sign 
key, is: 


Pout = rrs,A^,A,D,Z:(^ J]p(l^)C"(|6)(b| ® \b){b\UCV{EN-n'RN-n'{.) • ■ • EiRi{.)Eg{ 

b.b 

\M){M\ ® |d)(5|)EGi2i(.)tFt.. .i?jv-n'(-)^^Ln' ® |0)(0|®^ ® |?)(?|)ptctc/t|5)(5| ® |b)(6|)C")(44) 

where: 

• Ri{5i) corresponds the diagonal generalized Clifford operation controlled by the 

state of vector 5i. 

• Fi is the Eourier gate applied on qubit i. 

• "D is the Clifford unitary used to decode the output O' of the FK protocol phase which is 
encoded by the QECC used by the FK protocol. The decoding is applied by Bob in this case 
and the decoded state is contained in subsystem O of O'. 

• \b){b\ implement the measurements for the Toffoli gates at the ABE protocol phase and apply 
on some of the qubits of system O (see Figure]^. 

• r(r,b) is the classical bit string (system C) that Alice sends to Bob for the corrections of the 
Toffoli part of the ABE protocol. 

• C(r) is the Clifford part of the ABE protocol phase that implements the public polynomial- 
QECC logical circuit on system O. 
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• C"{r,b) contains the Pauli correction Cq, that Alice performs to the final returned system, 
that takes into account the updates of the keys due to the application of circuits T> and C. 
C" also contains the corrections to trap measurement results. 

• U represents global Bob’s attack that in this case applies also to system L. 
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Figure 3; Implementation of Toffoli gate with Toffoli state, Clifford operators and Pauli Z mea¬ 
surements. The corrections (which have to be performed by Bob depending on his communication 
with Alice) are the Clifford operators in the dashed boxes. 


Alice’s output can be rewritten, by decomposing the attack to the Pauli basis, tracing out 
system B and applying the honest computation on system T to separate it, as: 


Pout = TrM,A,D,c(^J2P^^^ ^ ak,u,valyyCQ,{\y){b'\ (g) |6) (g) Py 

bb ^ k,UyV,u' ,v' 

CP(iP'(|M')(M'| ® ® ® \b)(b\)cS, 

<^\bk+rt,){bt,\Pu\u\rti){rt^\Pu'\u\bti){bu+rti\)) (45) 

i 

where 

• ak,u,v are complex numbers, with Y.k,u,v Wk,u,v\‘^ = 1- 

• Pu (and Pu>) ranges over all general d-level Pauli operators and applies on the system that is 
trapified. 

• Py (and Pyi) ranges over all general d-level Pauli operators and applies on the system that is 
not trapified: O" x A x £. 

• Py^i is the Tth generalized Pauli element of Pu (similarly for Py). 

• b' is the vector that is generated from b by removing elements {bt^}. 

We notice that we can extract a random logical Pauli (g) Z ’'2 (g) from state |000) that is 
used to prepare the Toffoli gate (Figure]^ and notice that the dependences on {r'i,r 2 ,r'^) cancel in 
all systems except system C. Then, summing over {r[,r 2 ,r'^) gives the maximally mixed state for 
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system C and thus taking the trace of it cancels all cross terms of the corresponding attack. The 
rest of the arguments follow the corresponding part of the proof of Theorem 

Therefore state pout can be rewritten to eliminate all Pauli cross terms from the attack of Bob 
that are different. 


pout — 

bb * k,u,v 


where 

• is the tensor product of |+o) for all qudits of system M. x O'. 

• 'pO) ig the unitary that contains E'q for M. x O' and FiRi{4>'-{bf-i(^ipbj-i{j ~ i,j / /(*))) 
operators for all qudits of system At. 

• Cq, are the corrections on the output of the ABE protocol phase (after eliminating the r’s) 
and depend on b' and b . 


Restricting the summation to n G 5i where 5i is the set of general d-level Pauli operators that 
contain < di elements which have a generalized Pauli X component (where di is the number of 
correctable errors of the code) and applying the same steps as in the corresponding part of the 
proof of Theorem the state becomes: 


b t k,u£Si,v 




pi pi I pt 


( 3 )^ 




u\ti 


p. 


u\ti 


(47) 


The fact that the graph is partitioned into sub-graphs, to encode the different logical states to 
be used in the ABE protocol phase does not change the above statement because a global attack 

with footprint < di will necessarily have footprint < di in each sub-graph. We can also eliminate 
( 3 ) 

Cq/ by commuting with the Pauli attack operators. 

By separating the terms that leave all traps untouched and the rest we get: 


fji = 


J2pP\i^c){^c\P ® |AC'C'i)(ACCi| + J2PjPM)i^c\Pj ® \REJi){RER\ (48) 


where 

• Pi {Pj) range over all general d-level Pauli operators on the final returned system. 

• P'i , Pi are probabilities with Y.i{p'i+P'l) = Efc,ne-Si,j; W,u,v? ■ 

• IACCi)(AC'C'i| is the state where all trap qubits are |0)(0| and |i?£'Ji)(REJi| denotes any 
state that at least one trap is |1)(1|. 

• |'0c)(V’cl is the state, encoded by the signed polynomial QECC, after the correct computation 
of the ABE protocol phase is performed and undoing the Pauli key. 
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The rest of the terms of the summation in the state pout { u ^ S 2 ) are considered. Let Pj_ be 
the projection to the orthogonal space to the correct output state: 

P± = /-|V'')(V^'| (49) 

We calculate the ‘bad’ probability pbad the state collapses to the ‘incorrect’ subspace and no 
trap is activated. 


Pbad = rr(^ ^p(t)PL |0)t,(0|t. ^ \ak,u,v?C^o}{{h'\ ® ® Pv\0" 

55 t i k,u&S 2 ,v 

(CP(p(3)(|M(3))(M(3)|)p(3)t)ptct)p^|.^.^.^^, ^ ^ |b)(6|)cg)t(g)P„|,JO)(0|P„l*J (50) 

i 

Tracing out everything except the trap system: 


< Tr(^p(t)| 0 )i.( 0 |f. \ak,u,v?^Pu\u\^)u{^\tiPu\u] 

t k,u&S 2 ,v i 


(51) 


The rest is the same to the corresponding part in the proof of Theorem giving the final state: 


^2 ~^/(iz^PilV’')(V’cl ® \ACCi){ACCi\ +P2P0\REJ,){REJ,\ (52) 

where pi +P 2 = Ylk,ueS 2 ,v \0'k,u,v\‘^ and p is a density matrix. 

By summing the states ui and (T 2 and by contractiveness of the ABE protocol detection proce¬ 
dure that Alice applies to check if the state is in the valid space of the signed polynomial QECC, 
Theorem |is satisfied with ei = y^(l — c')'^i and €2 = (1/2)^'^. 
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